From 9fb8f18c1b58a8291db34b03e84e773d307c1d30 Mon Sep 17 00:00:00 2001 From: Ryan Zuklie Date: Thu, 28 Sep 2023 15:50:59 -0700 Subject: [PATCH] Remove debug only restrictions to network tracing Network tracing was only available on userdebug and eng builds. This change makes it available on all build types behind a flag. Bug: 298197881 Test: flash & trace, toggle flag on/off Change-Id: I75d854aee74adf7e23f7a970b20233790f9b0354 --- bpf_progs/netd.c | 27 ++++++++++++++++--- .../NetworkStatsServiceInitializer.java | 14 ++++++---- tests/mts/bpf_existence_test.cpp | 12 +++++++++ 3 files changed, 44 insertions(+), 9 deletions(-) diff --git a/bpf_progs/netd.c b/bpf_progs/netd.c index f86d8fd3c6..256dd6a26c 100644 --- a/bpf_progs/netd.c +++ b/bpf_progs/netd.c @@ -104,14 +104,13 @@ DEFINE_BPF_MAP_NO_NETD(iface_index_name_map, HASH, uint32_t, IfaceValue, IFACE_I DEFINE_BPF_MAP_EXT(packet_trace_enabled_map, ARRAY, uint32_t, bool, 1, AID_ROOT, AID_SYSTEM, 0060, "fs_bpf_net_shared", "", false, BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, LOAD_ON_ENG, - IGNORE_ON_USER, LOAD_ON_USERDEBUG) + LOAD_ON_USER, LOAD_ON_USERDEBUG) -// A ring buffer on which packet information is pushed. This map will only be loaded -// on eng and userdebug devices. User devices won't load this to save memory. +// A ring buffer on which packet information is pushed. DEFINE_BPF_RINGBUF_EXT(packet_trace_ringbuf, PacketTrace, PACKET_TRACE_BUF_SIZE, AID_ROOT, AID_SYSTEM, 0060, "fs_bpf_net_shared", "", false, BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, LOAD_ON_ENG, - IGNORE_ON_USER, LOAD_ON_USERDEBUG); + LOAD_ON_USER, LOAD_ON_USERDEBUG); // iptables xt_bpf programs need to be usable by both netd and netutils_wrappers // selinux contexts, because even non-xt_bpf iptables mutations are implemented as @@ -504,6 +503,16 @@ static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, boo return match; } +// This program is optional, and enables tracing on Android U+, 5.8+ on user builds. +DEFINE_BPF_PROG_EXT("cgroupskb/ingress/stats$trace_user", AID_ROOT, AID_SYSTEM, + bpf_cgroup_ingress_trace_user, KVER(5, 8, 0), KVER_INF, + BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, true, + "fs_bpf_netd_readonly", "", true, false, true) +(struct __sk_buff* skb) { + return bpf_traffic_account(skb, INGRESS, TRACE_ON, KVER(5, 8, 0)); +} + +// This program is required, and enables tracing on Android U+, 5.8+, userdebug/eng. DEFINE_BPF_PROG_EXT("cgroupskb/ingress/stats$trace", AID_ROOT, AID_SYSTEM, bpf_cgroup_ingress_trace, KVER(5, 8, 0), KVER_INF, BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, false, @@ -524,6 +533,16 @@ DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$4_14", AID_ROOT, AID_SY return bpf_traffic_account(skb, INGRESS, TRACE_OFF, KVER_NONE); } +// This program is optional, and enables tracing on Android U+, 5.8+ on user builds. +DEFINE_BPF_PROG_EXT("cgroupskb/egress/stats$trace_user", AID_ROOT, AID_SYSTEM, + bpf_cgroup_egress_trace_user, KVER(5, 8, 0), KVER_INF, + BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, true, + "fs_bpf_netd_readonly", "", true, false, true) +(struct __sk_buff* skb) { + return bpf_traffic_account(skb, EGRESS, TRACE_ON, KVER(5, 8, 0)); +} + +// This program is required, and enables tracing on Android U+, 5.8+, userdebug/eng. DEFINE_BPF_PROG_EXT("cgroupskb/egress/stats$trace", AID_ROOT, AID_SYSTEM, bpf_cgroup_egress_trace, KVER(5, 8, 0), KVER_INF, BPFLOADER_IGNORED_ON_VERSION, BPFLOADER_MAX_VER, false, diff --git a/service-t/src/com/android/server/NetworkStatsServiceInitializer.java b/service-t/src/com/android/server/NetworkStatsServiceInitializer.java index 82a4fbdfe4..675e5a1057 100644 --- a/service-t/src/com/android/server/NetworkStatsServiceInitializer.java +++ b/service-t/src/com/android/server/NetworkStatsServiceInitializer.java @@ -22,6 +22,7 @@ import android.os.Build; import android.util.Log; import com.android.modules.utils.build.SdkLevel; +import com.android.net.module.util.DeviceConfigUtils; import com.android.server.net.NetworkStatsService; /** @@ -30,6 +31,8 @@ import com.android.server.net.NetworkStatsService; */ public final class NetworkStatsServiceInitializer extends SystemService { private static final String TAG = NetworkStatsServiceInitializer.class.getSimpleName(); + private static final String ENABLE_NETWORK_TRACING = "enable_network_tracing"; + private final boolean mNetworkTracingFlagEnabled; private final NetworkStatsService mStatsService; public NetworkStatsServiceInitializer(Context context) { @@ -37,6 +40,8 @@ public final class NetworkStatsServiceInitializer extends SystemService { // Load JNI libraries used by NetworkStatsService and its dependencies System.loadLibrary("service-connectivity"); mStatsService = maybeCreateNetworkStatsService(context); + mNetworkTracingFlagEnabled = DeviceConfigUtils.isTetheringFeatureEnabled( + context, ENABLE_NETWORK_TRACING); } @Override @@ -48,11 +53,10 @@ public final class NetworkStatsServiceInitializer extends SystemService { TrafficStats.init(getContext()); } - // The following code registers the Perfetto Network Trace Handler on non-user builds. - // The enhanced tracing is intended to be used for debugging and diagnosing issues. This - // is conditional on the build type rather than `isDebuggable` to match the system_server - // selinux rules which only allow the Perfetto connection under the same circumstances. - if (SdkLevel.isAtLeastU() && !Build.TYPE.equals("user")) { + // The following code registers the Perfetto Network Trace Handler. The enhanced tracing + // is intended to be used for debugging and diagnosing issues. This is enabled by default + // on userdebug/eng builds and flag protected in user builds. + if (SdkLevel.isAtLeastU() && (mNetworkTracingFlagEnabled || !Build.TYPE.equals("user"))) { Log.i(TAG, "Initializing network tracing hooks"); NetworkStatsService.nativeInitNetworkTracing(); } diff --git a/tests/mts/bpf_existence_test.cpp b/tests/mts/bpf_existence_test.cpp index 15263ccbf1..0c424e92dd 100644 --- a/tests/mts/bpf_existence_test.cpp +++ b/tests/mts/bpf_existence_test.cpp @@ -129,6 +129,16 @@ static const set MAINLINE_FOR_T_5_15_PLUS = { SHARED "prog_dscpPolicy_schedcls_set_dscp_ether", }; +// Provided by *current* mainline module for U+ devices +static const set MAINLINE_FOR_U_PLUS = { + NETD "map_netd_packet_trace_enabled_map", +}; + +// Provided by *current* mainline module for U+ devices with 5.10+ kernels +static const set MAINLINE_FOR_U_5_10_PLUS = { + NETD "map_netd_packet_trace_ringbuf", +}; + static void addAll(set& a, const set& b) { a.insert(b.begin(), b.end()); } @@ -171,6 +181,8 @@ TEST_F(BpfExistenceTest, TestPrograms) { // U requires Linux Kernel 4.14+, but nothing (as yet) added or removed in U. if (IsAtLeastU()) ASSERT_TRUE(isAtLeastKernelVersion(4, 14, 0)); + DO_EXPECT(IsAtLeastU(), MAINLINE_FOR_U_PLUS); + DO_EXPECT(IsAtLeastU() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_U_5_10_PLUS); // V requires Linux Kernel 4.19+, but nothing (as yet) added or removed in V. if (IsAtLeastV()) ASSERT_TRUE(isAtLeastKernelVersion(4, 19, 0));